MISP integration

Overview

MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform for sharing, storing, and correlating Indicators of Compromise (IOCs) of targeted attacks, threat intelligence, financial fraud information, vulnerability information, or even counter-terrorism information. This tool provides CRUD operations on MISP resources including events, attributes, organisations, feeds, galaxies, noticelists, objects, tags, users, and warninglists.

Node Type

Action — processes input items and produces output

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires MISP API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Attribute	attribute
Event	event
Event Tag	eventTag
Feed	feed
Galaxy	galaxy
Noticelist	noticelist
Object	object
Organisation	organisation
Tag	tag
User	user
Warninglist	warninglist

Operations

Each resource has its own Operation list, and most resources reuse the same operation values (create, delete, get, getAll, update). Pick the resource first, then the operation.

Resource	Operation	Value
Attribute	Create	create
Attribute	Delete	delete
Attribute	Get	get
Attribute	Get Many	getAll
Attribute	Search	search
Attribute	Update	update
Event	Create	create
Event	Delete	delete
Event	Get	get
Event	Get Many	getAll
Event	Publish	publish
Event	Search	search
Event	Unpublish	unpublish
Event	Update	update
Event Tag	Add	add
Event Tag	Remove	remove
Feed	Create	create
Feed	Disable	disable
Feed	Enable	enable
Feed	Get	get
Feed	Get Many	getAll
Feed	Update	update
Galaxy	Delete	delete
Galaxy	Get	get
Galaxy	Get Many	getAll
Noticelist	Get	get
Noticelist	Get Many	getAll
Object	Search	search
Organisation	Create	create
Organisation	Delete	delete
Organisation	Get	get
Organisation	Get Many	getAll
Organisation	Update	update
Tag	Create	create
Tag	Delete	delete
Tag	Get Many	getAll
Tag	Update	update
User	Create	create
User	Delete	delete
User	Get	get
User	Get Many	getAll
User	Update	update
Warninglist	Get	get
Warninglist	Get Many	getAll

Parameters

Parameter values are sent to MISP exactly as you type them — this node does not evaluate {{ … }} expressions in its fields, so enter literal values. To drive a MISP call from upstream data, build the value in an Edit Fields or Code node first and read it back into a fixed field.

Distribution levels are numeric and mean the same thing everywhere they appear. Choosing 4 (Sharing Group) also requires a Sharing Group ID; leaving it blank fails the item with a clear message. Update operations reject an empty Update Fields collection rather than sending a no-op request.

Attribute: Create

Parameter	Type	Required	Default	Description
Event UUID (eventId)	string	Yes	—	UUID of the event to attach the attribute to.
Type	options	Yes	text	The attribute type.
				Options: text, url, comment
Value	string	Yes	—	The attribute value — the indicator itself.
Additional Fields	collection	No	{}	Optional attribute properties.
— Distribution	options	No	0	Who will be able to see this event once published.
				Options: 0 (your organization only), 1 (this community only), 2 (connected communities), 3 (all communities), 4 (sharing group), 5 (inherit event)
— Sharing Group ID	string	No	—	Required when Distribution is set to Sharing Group. The numeric ID of the sharing group.

Attribute: Get

Parameter	Type	Required	Default	Description
Attribute ID	string	Yes	—	UUID or numeric ID of the attribute.

Attribute: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

Attribute: Search

Parameter	Type	Required	Default	Description
Use JSON to Specify Fields	boolean	No	false	Whether to use JSON to specify the fields for the search request.
JSON (jsonOutput)	json	No	{ "value": "search value", "type": "text" }	JSON body for the restSearch endpoint. See MISP API docs for available fields. (shown when Use JSON to Specify Fields is true)
Value	string	Yes	—	The value to search for, e.g. an IP address or hash. (shown when Use JSON to Specify Fields is false)
Additional Fields	collection	No	{}	Extra search criteria. (shown when Use JSON to Specify Fields is false)
— Category	string	No	—	Restrict the search to one MISP category, e.g. Internal reference.
— Deleted	boolean	No	false	Whether to include deleted attributes.
— Tags	string	No	—	Comma-separated list of tags.
— Type	string	No	—	Restrict the search to one attribute type, e.g. text.
— Published	boolean	No	false	Whether to restrict the search to published data.

Attribute: Update

Parameter	Type	Required	Default	Description
Attribute ID	string	Yes	—	ID of the attribute to update.
Update Fields	collection	No	{}	Attribute properties to change. Only the fields you add are sent, and at least one is required.
— Distribution	options	No	0	Who will be able to see this event once published.
				Options: 0 (your organization only), 1 (this community only), 2 (connected communities), 3 (all communities), 4 (sharing group), 5 (inherit event)
— Sharing Group ID	string	No	—	Required when Distribution is set to Sharing Group.

Attribute: Delete

Parameter	Type	Required	Default	Description
Attribute ID	string	Yes	—	UUID or numeric ID of the attribute.

Event: Create

Parameter	Type	Required	Default	Description
Organization ID (org_id)	string	Yes	—	The numeric ID of the organization. Find IDs in the MISP dashboard under /organisations.
Information	string	Yes	—	Information on the event - max 65535 characters.
Additional Fields	collection	No	{}	Optional event properties.
— Analysis	options	No	0	Analysis maturity level of the event.
				Options: 0 (initial), 1 (ongoing), 2 (complete)
— Distribution	options	No	0	Who will be able to see this event once published.
				Options: 0 (your organization only), 1 (this community only), 2 (connected communities), 3 (all communities), 4 (sharing group), 5 (inherit event)
— Sharing Group ID	string	No	—	Required when Distribution is set to Sharing Group.
— Threat Level ID	options	No	1	The threat level assigned to the event.
				Options: 1 (high), 2 (medium), 3 (low), 4 (undefined)

Event: Get

Parameter	Type	Required	Default	Description
Event ID	string	Yes	—	UUID or numeric ID of the event.

Event: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

Event: Search

Parameter	Type	Required	Default	Description
Use JSON to Specify Fields	boolean	No	false	Whether to use JSON to specify the fields for the search request.
JSON (jsonOutput)	json	No	{ "value": "search value", "type": "text" }	JSON body for the restSearch endpoint. See MISP API docs for available fields. (shown when Use JSON to Specify Fields is true)
Value	string	Yes	—	The value to search for, e.g. an IP address or hash. (shown when Use JSON to Specify Fields is false)
Additional Fields	collection	No	{}	Extra search criteria. (shown when Use JSON to Specify Fields is false)
— Category	string	No	—	Restrict the search to one MISP category, e.g. Internal reference.
— Deleted	boolean	No	false	Whether to include deleted data.
— Search All	string	No	—	Search by matching any tag names, event descriptions, attribute values or attribute comments.
— Tags	string	No	—	Comma-separated list of tags.
— Type	string	No	—	Restrict the search to one attribute type, e.g. text.
— Published	boolean	No	false	Whether to restrict the search to published data.

Event: Update

Parameter	Type	Required	Default	Description
Event ID	string	Yes	—	UUID or numeric ID of the event.
Update Fields	collection	No	{}	Event properties to change. Only the fields you add are sent, and at least one is required.
— Analysis	options	No	0	Analysis maturity level of the event.
				Options: 0 (initial), 1 (ongoing), 2 (complete)
— Distribution	options	No	0	Who will be able to see this event once published.
				Options: 0 (your organization only), 1 (this community only), 2 (connected communities), 3 (all communities), 4 (sharing group), 5 (inherit event)
— Information	string	No	—	Information on the event - max 65535 characters.
— Sharing Group ID	string	No	—	Required when Distribution is set to Sharing Group.
— Threat Level ID	options	No	1	The threat level assigned to the event.
				Options: 1 (high), 2 (medium), 3 (low), 4 (undefined)

Event: Publish

Parameter	Type	Required	Default	Description
Event ID	string	Yes	—	UUID or numeric ID of the event.

Event: Unpublish

Parameter	Type	Required	Default	Description
Event ID	string	Yes	—	UUID or numeric ID of the event.

Event: Delete

Parameter	Type	Required	Default	Description
Event ID	string	Yes	—	UUID or numeric ID of the event.

Event Tag: Add

Parameter	Type	Required	Default	Description
Event ID	string	Yes	—	UUID or numeric ID of the event.
Tag ID	string	Yes	—	Numeric ID of the tag. Find IDs via Tag > Get Many.

Event Tag: Remove

Parameter	Type	Required	Default	Description
Event ID	string	Yes	—	UUID or numeric ID of the event.
Tag ID	string	Yes	—	Numeric ID of the tag. Find IDs via Tag > Get Many.

Feed: Create

Parameter	Type	Required	Default	Description
Name	string	Yes	—	A name for the feed.
Provider	string	Yes	—	The organisation or source providing the feed.
URL	string	Yes	—	The URL the feed is fetched from.
Additional Fields	collection	No	{}	Optional feed properties.
— Distribution	options	No	0	Who will be able to see this event once published.
				Options: 0 (your organization only), 1 (this community only), 2 (connected communities), 3 (all communities), 4 (sharing group), 5 (inherit event)
— Rules (json)	string	No	—	Filter rules for the feed.

Feed: Get

Parameter	Type	Required	Default	Description
Feed ID	string	Yes	—	UUID or numeric ID of the feed.

Feed: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

Feed: Update

Parameter	Type	Required	Default	Description
Feed ID	string	Yes	—	ID of the feed to update.
Update Fields	collection	No	{}	Feed properties to change. Only the fields you add are sent, and at least one is required.
— Distribution	options	No	0	Who will be able to see this event once published.
				Options: 0 (your organization only), 1 (this community only), 2 (connected communities), 3 (all communities), 4 (sharing group), 5 (inherit event)
— Name	string	No	—	A new name for the feed.
— Provider	string	No	—	A new provider for the feed.
— Rules (rules)	json	No	—	Filter rules for the feed.
— URL	string	No	—	A new URL for the feed.

Feed: Enable

Parameter	Type	Required	Default	Description
Feed ID	string	Yes	—	UUID or numeric ID of the feed.

Feed: Disable

Parameter	Type	Required	Default	Description
Feed ID	string	Yes	—	UUID or numeric ID of the feed.

Galaxy: Get

Parameter	Type	Required	Default	Description
Galaxy ID	string	Yes	—	UUID or numeric ID of the galaxy.

Galaxy: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

Galaxy: Delete

Parameter	Type	Required	Default	Description
Galaxy ID	string	Yes	—	UUID or numeric ID of the galaxy.

Noticelist: Get

Parameter	Type	Required	Default	Description
Noticelist ID	string	Yes	—	Numeric ID of the noticelist.

Noticelist: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

Object: Search

Parameter	Type	Required	Default	Description
Use JSON to Specify Fields	boolean	No	false	Whether to use JSON to specify the fields for the search request.
JSON (jsonOutput)	json	No	{ "value": "search value", "type": "text" }	JSON body for the restSearch endpoint. See MISP API docs for available fields. (shown when Use JSON to Specify Fields is true)
Value	string	Yes	—	The value to search for, e.g. an IP address or hash. (shown when Use JSON to Specify Fields is false)
Additional Fields	collection	No	{}	Extra search criteria. (shown when Use JSON to Specify Fields is false)
— Category	string	No	—	Restrict the search to one MISP category, e.g. Internal reference.
— Deleted	boolean	No	false	Whether to include deleted data.
— Search All	string	No	—	Search by matching any tag names, event descriptions, attribute values or attribute comments.
— Tags	string	No	—	Comma-separated list of tags.
— Type	string	No	—	Restrict the search to one attribute type, e.g. text.
— Published	boolean	No	false	Whether to restrict the search to published data.

Organisation: Create

Parameter	Type	Required	Default	Description
Name	string	Yes	—	The organisation’s name.
Additional Fields	collection	No	{}	Optional organisation properties.
— Created by Email	string	No	—	The email address recorded as the creator.
— Description	string	No	—	A description of the organisation.
— Nationality	string	No	—	The organisation’s nationality.
— Sector	string	No	—	The organisation’s sector.
— Type	string	No	—	The organisation’s type.
— User Count	number	No	0	The number of users in the organisation.

Organisation: Get

Parameter	Type	Required	Default	Description
Organisation ID	string	Yes	—	UUID or numeric ID of the organisation.

Organisation: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

Organisation: Update

Parameter	Type	Required	Default	Description
Organisation ID	string	Yes	—	ID of the organisation to update.
Update Fields	collection	No	{}	Organisation properties to change. Only the fields you add are sent, and at least one is required.
— Description	string	No	—	A description of the organisation.
— Name	string	No	—	A new name for the organisation.
— Nationality	string	No	—	The organisation’s nationality.
— Sector	string	No	—	The organisation’s sector.
— Type	string	No	—	The organisation’s type.

Organisation: Delete

Parameter	Type	Required	Default	Description
Organisation ID	string	Yes	—	UUID or numeric ID of the organisation.

Tag: Create

Parameter	Type	Required	Default	Description
Name	string	Yes	—	The tag name.
Additional Fields	collection	No	{}	Optional tag properties.
— Color (colour)	string	No	—	Hex color code for the tag (e.g. #ff0000).

Tag: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

Tag: Update

Parameter	Type	Required	Default	Description
Tag ID	string	Yes	—	ID of the tag to update.
Update Fields	collection	No	{}	Tag properties to change. Only the fields you add are sent, and at least one is required.
— Color (colour)	string	No	—	Hex color code for the tag (e.g. #ff0000).
— Name	string	No	—	A new name for the tag.

Tag: Delete

Parameter	Type	Required	Default	Description
Tag ID	string	Yes	—	Numeric ID of the tag.

User: Create

Parameter	Type	Required	Default	Description
Email	string	Yes	—	The new user’s email address.
Role ID	string	Yes	—	Role IDs are available in the MISP dashboard at /roles/index.
Additional Fields	collection	No	{}	Optional user properties.
— GPG Key	string	No	—	The user’s public GPG key.
— Inviter Email or ID (invited_by)	string	No	—	User ID of the inviter. Find IDs via User > Get Many.
— Organization ID (org_id)	string	No	—	Numeric ID of the organization. Find IDs via Organisation > Get Many.

User: Get

Parameter	Type	Required	Default	Description
User ID	string	Yes	—	Numeric ID of the user.

User: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

User: Update

Parameter	Type	Required	Default	Description
User ID	string	Yes	—	ID of the user to update.
Update Fields	collection	No	{}	User properties to change. Only the fields you add are sent, and at least one is required.
— Email	string	No	—	A new email address for the user.
— GPG Key	string	No	—	The user’s public GPG key.
— Inviter ID (invited_by)	string	No	—	User ID of the inviter. Find IDs via User > Get Many.
— Organization ID (org_id)	string	No	—	Numeric ID of the organization. Find IDs via Organisation > Get Many.

User: Delete

Parameter	Type	Required	Default	Description
User ID	string	Yes	—	Numeric ID of the user.

Warninglist: Get

Parameter	Type	Required	Default	Description
Warninglist ID	string	Yes	—	Numeric ID of the warninglist.

Warninglist: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	10	Maximum number of items to process concurrently.

Output Data

The MISP response is merged onto the input item’s JSON at the top level — the returned fields sit alongside the fields the item already carried, so downstream nodes address them directly ({{ $json.uuid }}). A response field with the same name as an existing item field overwrites it. Binary data on the input item is forwarded.

Operations	Output
Every Get Many, and Attribute / Event / Object Search	One output item per record — a page of 50 events becomes 50 output items from a single input item. A response with no records produces no output items for that input.
Create, Get and Update on attributes, events, feeds, organisations, tags and users	One output item carrying the record, already unwrapped from its MISP envelope so its fields sit at the top level rather than under Attribute or Event.
Delete, Publish, Unpublish, Feed Enable and Disable, Event Tag Add and Remove	One output item carrying MISP’s confirmation message for the call.

An attribute arrives like this:

{
  "id": "12345",
  "event_id": "678",
  "object_id": "0",
  "category": "Other",
  "type": "text",
  "value": "203.0.113.10",
  "to_ids": false,
  "uuid": "5f8a7c1e-1234-4c5d-8e9f-0a1b2c3d4e5f",
  "timestamp": "1768478400",
  "distribution": "0",
  "sharing_group_id": "0",
  "comment": "",
  "deleted": false
}

Event: Get and Event: Update return the event without its attribute list. The Attribute array is removed so a single busy event cannot flood the workflow with a multi-megabyte item. To work with an event’s indicators, follow up with Attribute: Get Many or Attribute: Search.

Search results come back already unwrapped: an attribute search yields the attributes themselves, and event and object searches yield the events and objects. Turning Return All off trims the result list to the Limit.

Example Configuration

Create an event for a new incident:

{
  "type": "misp",
  "parameters": {
    "resource": "event",
    "operation": "create",
    "org_id": "1",
    "information": "Phishing campaign targeting finance team",
    "additionalFields": {
      "analysis": 1,
      "distribution": 1,
      "threat_level_id": 2
    }
  }
}

Attach an indicator to that event:

{
  "type": "misp",
  "parameters": {
    "resource": "attribute",
    "operation": "create",
    "eventId": "5f8a7c1e-1234-4c5d-8e9f-0a1b2c3d4e5f",
    "type": "url",
    "value": "http://malicious.example.com/login",
    "additionalFields": {
      "distribution": 5
    }
  }
}

Search attributes for a specific IOC:

{
  "type": "misp",
  "parameters": {
    "resource": "attribute",
    "operation": "search",
    "useJson": false,
    "value": "203.0.113.10",
    "additionalFields": {
      "type": "text",
      "tags": "tlp:amber,malware",
      "published": true
    }
  }
}

Run the same search with a raw restSearch body when you need fields the form does not expose:

{
  "type": "misp",
  "parameters": {
    "resource": "attribute",
    "operation": "search",
    "useJson": true,
    "jsonOutput": "{\"value\":\"203.0.113.10\",\"type\":\"ip-dst\",\"last\":\"7d\"}"
  }
}

List the most recent events:

{
  "type": "misp",
  "parameters": {
    "resource": "event",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50
  }
}

Publish an event so partner communities can see it:

{
  "type": "misp",
  "parameters": {
    "resource": "event",
    "operation": "publish",
    "eventId": "678"
  }
}

Tag an event:

{
  "type": "misp",
  "parameters": {
    "resource": "eventTag",
    "operation": "add",
    "eventId": "678",
    "tagId": "42"
  }
}

Create a tag with a colour:

{
  "type": "misp",
  "parameters": {
    "resource": "tag",
    "operation": "create",
    "name": "campaign:finance-phish",
    "additionalFields": {
      "colour": "#ff0000"
    }
  }
}

Register a threat feed:

{
  "type": "misp",
  "parameters": {
    "resource": "feed",
    "operation": "create",
    "name": "OSINT URL feed",
    "provider": "Example CERT",
    "url": "https://feeds.example.org/urls.json",
    "additionalFields": {
      "distribution": 3
    }
  }
}

Turn a feed on:

{
  "type": "misp",
  "parameters": {
    "resource": "feed",
    "operation": "enable",
    "feedId": "7"
  }
}

Add an analyst account:

{
  "type": "misp",
  "parameters": {
    "resource": "user",
    "operation": "create",
    "email": "analyst@example.org",
    "role_id": "3",
    "additionalFields": {
      "org_id": "1"
    }
  }
}

Create a partner organisation:

{
  "type": "misp",
  "parameters": {
    "resource": "organisation",
    "operation": "create",
    "name": "Example CERT",
    "additionalFields": {
      "description": "National CERT partner",
      "nationality": "BE",
      "sector": "Government",
      "type": "CERT"
    }
  }
}

Raise an event’s threat level:

{
  "type": "misp",
  "parameters": {
    "resource": "event",
    "operation": "update",
    "eventId": "678",
    "updateFields": {
      "threat_level_id": 1,
      "analysis": 2,
      "information": "Phishing campaign — confirmed compromise"
    }
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

This tool interacts with the MISP threat intelligence platform to manage events, attributes, and other intelligence objects. It is ideal when you need to perform create, read, update, or delete operations on specific MISP resources like events, attributes, or organizations. It produces updated MISP resources, search results, or the status of operations like publishing events or enabling feeds.